Investigating Endpoint Log Deletion for C2 Communication

SY0-701 By islever Editorial Last updated

Short answer

B Firewall

Question

A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted. Which of the following logs would the analyst most likely look at next?
  1. IPS
  2. Firewall Correct Answer
  3. AСL
  4. Windows security

Key Takeaways

This question tests log correlation and incident response procedures when local evidence is destroyed, with the common trap being confusion between network controls and access control lists.

When endpoint logs are tampered with during a C2 investigation, analysts pivot to network-level logging to trace suspicious outbound traffic. The SY0-701 community consistently emphasizes firewall logs as the primary fallback for reconstructing compromised host activity.

Common mistake: Candidates often select ACL (Option C) under the assumption that it tracks log deletion events, but ACLs only filter traffic rather than recording forensic timeline data or connection details.

Expert Analysis

Why the Answer Is Correct

When an attacker deletes local endpoint logs to cover their tracks, the analyst must immediately shift focus to centralized or network-perimeter logging sources. Firewall logs capture source/destination IPs, ports, protocols, and timestamps for all traversing traffic, making them ideal for identifying unauthorized outbound C2 communications. This aligns with standard incident response playbooks that prioritize preserving and analyzing network telemetry when host-based data is unavailable.

Why the Other Options Are Wrong

IPS logs (A) primarily record detected signatures and alerts rather than comprehensive connection metadata needed for full traffic reconstruction. ACLs (C) define permit/deny rules but do not generate audit trails of who modified logs or specific connection sessions. Windows Security logs (D) reside on the compromised endpoint and have already been deleted by the adversary, rendering them useless for this specific recovery step.

Community Comment Notes

Comment [1] correctly highlights that firewall logs reveal outbound patterns indicating C2 activity despite endpoint tampering. Comment [3] reinforces this by noting how perimeter logs help identify the malicious destination IP. While comment [2] suggests ACLs track log deletion, this misinterprets ACL functionality, which strictly governs traffic flow rather than system auditing.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always follow the principle of centralized logging in your exam answers; when local evidence is gone, pivot to network or SIEM sources. Look for keywords like "outbound," "command-and-control," and "logs deleted" to quickly eliminate host-based options and select perimeter monitoring tools.

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Kingamj 👍 4 Answered B
    Since the logs on the endpoint were deleted, the security analyst would likely turn to firewall logs. Firewall logs can provide information about network traffic, including outbound connections that may indicate communication with a command-and-control server. These logs can help the analyst identify suspicious traffic patterns or unauthorized communication that bypassed endpoint defenses.
  2. 1edea48 👍 2
    This isn't correct. The answer has to be C. In the question, it specifically states that the logs on the endpoint were deleted. That tells me that someone had access to those logs, which means there might have very well been tampering on the endpoint. The ACL has the ability to show us who was able to access those logs and when they were deleted.
  3. Glacier88 👍 1 Answered B
    While the endpoint logs themselves are deleted, the firewall logs might still provide valuable information. Firewalls typically record network traffic, including outbound connections, which could help the analyst identify the destination of the suspicious communication. By examining the firewall logs, the analyst might be able to determine the IP address of the command-and-control server and gather other relevant information about the incident.
  4. a4e15bd 👍 1
    B. Firewall

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide